FortiSIEM Critical Vulnerability Exploited by Remote Attackers

🚨 Critical authentication bypass vulnerability (CVSS 9.4) affecting Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, and potentially FortiSwitch Manager. ⚠️The flaw allows an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts when FortiCloud SSO authentication is enabled. It has been actively exploited in the wild. 🔗 Full advisory: https://hubs.ly/Q040ZkVl0 #CVE202624858 #fortinet #infosec

CSRF protection that only checks POST isn't actually protection. It's security theater. Easy!Appointments, an open-source scheduling system, had CSRF validation in place but it only ran on POST requests. Multiple admin endpoints accepted GET parameters for state-changing operations like creating admins and resetting passwords. Result: full account takeover via a malicious link. https://lnkd.in/gUhNDjcV • Audit your controllers for GET-based state changes - if you accept mutations via $_REQUEST or allow GET on write endpoints, your CSRF tokens are decorative • Make HTTP method semantics a CI gate - GET must be idempotent, mutations require POST/PUT/DELETE with token validation, no exceptions #AppSec #CSRF #DevSecOps

Chinese-nexus threat actor UAT-9686 is exploiting a vulnerability in Cisco AsyncOS to deploy AquaShell and gain persistent access, potentially exposing organizations to data theft and further compromise. Defenders should immediately verify AsyncOS configurations, ensuring the Spam Quarantine service is not exposed on public ports. ⚠️ #CyberNewsLive https://lnkd.in/ey9xAhdS

Critical RCE Vulnerability in FortiSIEM Actively Exploited via Port 7900 📌 A critical RCE vulnerability in FortiSIEM is being actively exploited through port 7900, putting organizations at serious risk. Attackers are leveraging this flaw to gain unauthorized access, with IoCs pointing to ongoing real-time campaigns. Fortinet urges immediate action to secure affected systems. 🔗 Read more: https://lnkd.in/dPsBfMnm #Tech #News

🚨 CVE-2025-64155: FortiSIEM Under Active Exploitation Fortinet has patched a critical unauthenticated RCE flaw (CVSS 9.8) in FortiSIEM, allowing remote root-level command execution via crafted TCP requests. Within hours of disclosure, in-the-wild attacks were reported. 🔍 Affected: FortiSIEM 6.7–7.4 (Super & Worker nodes only) ⚙️ Fix: Upgrade to latest versions or restrict port 7900 (phMonitor) access. Greenbone detects CVE-2025-64155 and related Fortinet CVEs through our remote banner check. https://lnkd.in/dgWwXXbA Test your network with a free 2‑week OPENVAS BASIC trial. https://lnkd.in/dcZ_Bg3A #CVE202564155 #Fortinet #FortiSIEM #RCE #OPENVAS #Greenbone #VulnerabilityManagement

Last week I gained hands-on experience configuring and troubleshooting secure network and firewall infrastructure in a mission environment. Key takeaways: - Configured and managed firewall gateways, ACLs, and rule hierarchies to control traffic flow and enforce security policy - Worked with Forcepoint NGFW and integrated gateways between routers, switches, and management systems -Supported NSA Type 1 encrypted communications using the TACLANE, including key loading with SKL, PPK chain creation, and crypto parameter validation -Adjusted IPv4 settings to ensure reliable data transfer across encrypted networks and enclaves -Performed firewall and network troubleshooting using logs, ping, and traceroute to identify and resolve connectivity issues -Updated virtual network interfaces and permissions within RHEL, using both GUI and CLI tools (WinSCP, PuTTY, permission hardening) This experience strengthened my understanding of secure network design, encryption, and real-world troubleshooting in operational environments. #Firewall #RHEL #NetworkSecurity #Encryption

Last week we helped a 45-person company stop a takeover attempt… even though the attacker had a real password. How? We treated identity like the perimeter. 5 quick wins SMBs can implement fast: 1) Move to phishing-resistant MFA • Use passkeys / FIDO2 security keys where possible • Reduce or eliminate SMS MFA 2) Turn on Conditional Access • Require MFA for risky sign-ins • Block “impossible travel,” suspicious locations, and odd hours 3) Enforce device trust • Require compliant, managed devices for email/apps • Encrypt laptops + require screen lock 4) Remove admin by default • Least privilege + just-in-time admin access 5) Alert on identity risk • Sign-in alerts, new device alerts, and admin role changes Want our quick checklist to roll this out? Comment “IDENTITY” and we’ll send it. : Gerald Walker | Interactive America, Inc. (IA-Tech Center) ia-techcenter.com

Got $$$$ from multiple HackerOne programs 🎉 A mix of privilege escalation and broken access control issues cases where limited roles or tokens were able to do more than intended. This is a good reminder that security isn’t just about admin users. Every role, permission, and edge case matters. Least privilege + strict server-side checks are everything. #BugBounty #HackerOne #AccessControl #SecurityResearch

When access fails, it’s not the user. It’s identity. 🔐🖥️ In most corporate environments, Domain Controllers and Active Directory are at the core of authentication, access control and security policies. Any degradation there has an immediate and widespread impact. Replication issues, authentication errors, latency or overload often go unnoticed until users are affected ⚠️ And when that happens, both operations and security suffer. That’s why continuous monitoring of Active Directory and Domain Controllers is essential, fully integrated with the rest of the infrastructure. With Pandora FMS, IT teams can correlate identity, performance and availability to stay ahead of incidents. 📌 Corporate identity isn’t just another service. It’s a foundation of operational continuity. 🔗 https://lnkd.in/eZG-HY4Z #ActiveDirectory #DomainControllers #DigitalIdentity #ITSecurity #Monitoring #ITOperations #PandoraFMS

𝐒𝐡𝐚𝐫𝐢𝐧𝐠 𝐚 𝐫𝐞𝐚𝐥-𝐰𝐨𝐫𝐥𝐝 𝐄𝐃𝐑 𝐚𝐥𝐞𝐫𝐭 𝐢𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧 𝐮𝐬𝐢𝐧𝐠 𝐂𝐫𝐨𝐰𝐝𝐒𝐭𝐫𝐢𝐤𝐞 𝐅𝐚𝐥𝐜𝐨𝐧 Today,I analyzed an endpoint security alert in CrowdStrike Falcon EDR related to 𝐥𝐬𝐚𝐬𝐬.𝐞𝐱𝐞 process execution, which typically requires careful validation due to its sensitivity in Windows systems. As part of the investigation, I reviewed the process execution path, parent process behavior, and endpoint context. The process was running from the legitimate location: 𝐂:\𝐖𝐢𝐧𝐝𝐨𝐰𝐬\𝐒𝐲𝐬𝐭𝐞𝐦𝟑𝟐\𝐥𝐬𝐚𝐬𝐬.𝐞𝐱𝐞 No abnormal behavior or suspicious child processes were observed. Since attackers often attempt to masquerade critical system processes from non-standard directories, path validation was a key factor in this analysis. Based on these findings, the alert was confirmed as a 𝐟𝐚𝐥𝐬𝐞 𝐩𝐨𝐬𝐢𝐭𝐢𝐯𝐞 and closed. This investigation highlighted how context-driven analysis is essential when validating EDR alerts. #CrowdStrike #EDR #SOCAnalyst #EndpointSecurity #ThreatAnalysis